Wake up Neo: detecting virtualization through speculative execution

No ratings

Presented at Insomni'Hack 2019 by

Innokentii Sennovskii

There has been several Speculative Execution vulnerabilities allowing to read privileged data from kernel mode, other processes and even hypervisors. However, there are several more ways in which speculative execution can be leveraged by adversaries. I have discovered one such technique, which allows the attacker on the system to get information allowing them to evade detection by modern sandboxes and AV software. This technique led to the discovery of Spectre Variant 3a virtualization detection vulnerability in Intel CPUs. This virtualization detection technique stands apart from other techniques, since it can't be evaded by fixing rdtsc timing on vmexits and it doesn't require CPL=0. It can also thwart a reverse engineer analyzing it in a VM, since instead of binary checks for virtualization and specific sandboxes, the computation of initial data (such as keys for unpacking) can be turned off opaquely by virtualization.